K7 CyberSecurity highlights DPDP breach-reporting obligations for ransomware attacks - Daily Pioneer
K7 CyberSecurity has released a white paper explaining how ransomware attacks can trigger breach-reporting obligations under India's Digital Personal Data Protection (DPDP) Act, even without data theft.
The white paper, 'Turning DPDP Compliance into a Security-Led Capability: From Endpoint to SOC,' examines the 72-hour reporting requirement, evidence preservation, third-party accountability and AI-powered Security Operations Centres (SOCs).
Operational Safeguards Required
The document highlights the need for enterprises to demonstrate that security safeguards are operational and effective. From 13 May 2027, a ransomware incident that makes personal data inaccessible can trigger breach notification even without theft.
DPDP readiness is not just about documenting safeguards; enterprises must demonstrate that they work.
Security Operations Focus
Boards should ask: can we establish what happened, which controls worked and how we responded? Connecting protection, investigation and evidence from endpoint to SOC helps answer that. As AI enters security operations, organisations must also understand where their security data is processed.
Related
